Mahara Labs

Challenge

Most multi-tenant products leak eventually, and they leak for the same reason: isolation is a filter the author has to remember to write, hundreds of times, forever. One omission is a cross-tenant disclosure. We wanted a platform where forgetting is not possible, and we wanted to find out what running it in anger actually costs — so we made ourselves the first customer rather than the vendor.

Approach

1. 01

   Enforced tenant scope in a Prisma client extension rather than per query. Forty-two models are registered; a model with a workspace column that is missing from the registry fails a build gate, because that exact omission caused a leak once.

2. 02

   Made the guard prove itself. It checks that a registered model actually has the column, not merely that it exists — a contract test reintroduces the bug and asserts the audit exits non-zero.

3. 03

   Built leads, contacts, segments, tags and a stage-based deal pipeline with stage history, on a shared event log with idempotency keys so a replayed webhook cannot double-write.

4. 04

   Shipped email, SMS, WhatsApp and Telegram campaign surfaces over a common send-job worker, with provider credentials wrapped in AES-256-GCM bound to their own row id so a restored dump cannot silently decrypt elsewhere.

5. 05

   Wrote an audit action for every mutation and a drift audit that fails the build when one is missing. Sixty-five actions are labelled.

6. 06

   Added an attention engine that surfaces what is going wrong — stale leads, failed sends, expiring credentials — with a real dismiss, acknowledge and snooze lifecycle rather than a badge.

7. 07

   Covered it with 153 end-to-end tests against a production build, plus automated accessibility and responsive scans that fail on any critical or serious violation.

Outcome

Running it ourselves found twelve defects that no amount of reading would have: server actions could not resolve their workspace at all, so every operator mutation failed; the audit trail dropped exactly the rows operator actions should have written; campaigns could not be created on any channel. All were shipping. Social publishing, ad management and the SEO module are on the roadmap and are not claimed here.